We are building a force.com site application for a company. It will be used by the company's employees who will login into the application using the company's own login page (which uses their own authentication server).

Currently, the company uses SAML (Security Assertion Markup Language) as a single sign-on mechanism where the IDP (Identity Provider) is the company and the service provider is Salesforce. So their employees log in their Salesforce instances using a single sign on page which is maintained by the company.

The company wants the users to log in the force.com site application through this same system. I am confused on how to implement SAML with force.com site. Talking to them it seems they create a server cookie and a session at their backend and it is not sent to the browser as cookie or anything. So what do I check against for a successful login? Any help or suggestions will be much appreciated.

1 Answer 1


If I understand your question correctly, this should be the approach you should be following. Force.com sites do support SSO using SAML.

You need to provide the following info for your identity provider

Organization ID

Portal ID

Sites URL

The following must be added as attributes to the SAML assertion sent from your identity provider:




If you wanted to use SAML for Sites for when a service provider initiates sign-on, you must first create a Visualforce page that provides a redirect to your server. The following is an example:

<apex:page showHeader="false" sidebar="false">
     var PingSpURL = "https://my.pingserver.com:9031/idp/startSSO.ping?PartnerSpId=salesforce.com.sp";
     var siteLoginPage = "&TargetResource={!$Site.CurrentSiteUrl}siteLogin?startUrl={!$Site.OriginalUrl}";
     window.location = PingSpURL+siteLoginPage;
  • So my service provider login will pass those 3 things to the IDP and after the IDP asserts the user correctly it will send a true/false flag to the service provider (my force.com site application) based on which I will let them in? Commented Jun 2, 2016 at 16:23
  • The SAML in my case is an IDP initiated login. I am confused about the "assertion". Where do I look for organization_id or any other information sent through SAML? Is it part of request headers? Commented Jun 10, 2016 at 18:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .